← All changes | src/Controller/Frontend/RedirectController.php +36 -120 trunk → 2.3.14 View file →

		@@ -9,13 +9,12 @@
9	9	use UserAccessManager\Cache\Cache;
10	10	use UserAccessManager\Config\MainConfig;
11	11	use UserAccessManager\Config\WordpressConfig;
12	12	use UserAccessManager\Controller\Controller;
13		-use UserAccessManager\Controller\Frontend\Authentication\LoginControllerTrait;
14	13	use UserAccessManager\Database\Database;
15	14	use UserAccessManager\File\FileHandler;
16		-use UserAccessManager\File\Delivery\FileObject;
17		-use UserAccessManager\File\Delivery\FileObjectFactory;
	15	+use UserAccessManager\File\FileObject;
	16	+use UserAccessManager\File\FileObjectFactory;
18	17	use UserAccessManager\Object\ObjectHandler;
19	18	use UserAccessManager\UserGroup\UserGroupTypeException;
20	19	use UserAccessManager\Util\Util;
21	20	use UserAccessManager\Wrapper\Php;
		@@ -25,9 +24,8 @@
25	24	{
26	25	use LoginControllerTrait;
27	26
28	27	public const POST_URL_CACHE_KEY = 'PostUrls';
29		- public const REDIRECT_TO_PARAMETER = 'redirect_to';
30	28
31	29	public function __construct(
32	30	Php $php,
33	31	Wordpress $wordpress,
		@@ -74,126 +72,48 @@
74	72
75	73	return $postUrls[$url];
76	74	}
77	75
78		- private function normalizeAttachmentUrl(array $uploadDirs, string $objectUrl): string
	76	+ private function getFileSettingsByType(string $objectType, string $objectUrl): ?FileObject
79	77	{
80		- $uploadDir = str_replace(ABSPATH, '/', $uploadDirs['basedir']);
81		- $regex = '/.*' . str_replace('/', '\/', $uploadDir) . '\//i';
82		- $cleanObjectUrl = preg_replace($regex, '', $objectUrl);
83		- $uploadUrl = str_replace('/files', $uploadDir, $uploadDirs['baseurl']);
	78	+ $fileObject = null;
84	79
85		- return rtrim($uploadUrl, '/') . '/' . ltrim($cleanObjectUrl, '/');
86		- }
	80	+ if ($objectType === ObjectHandler::ATTACHMENT_OBJECT_TYPE) {
	81	+ $uploadDirs = $this->wordpress->getUploadDir();
	82	+ $uploadDir = str_replace(ABSPATH, '/', $uploadDirs['basedir']);
	83	+ $regex = '/.*' . str_replace('/', '\/', $uploadDir) . '\//i';
	84	+ $cleanObjectUrl = preg_replace($regex, '', $objectUrl);
	85	+ $uploadUrl = str_replace('/files', $uploadDir, $uploadDirs['baseurl']);
	86	+ $objectUrl = rtrim($uploadUrl, '/') . '/' . ltrim($cleanObjectUrl, '/');
87	87
88		- private function isRegisteredSize(int $attachmentId, string $fileName): bool
89		- {
90		- $metaData = $this->wordpress->getAttachmentMetadata($attachmentId);
91		- $sizes = is_array($metaData) === true ? (array) ($metaData['sizes'] ?? []) : [];
	88	+ $post = $this->objectHandler->getPost($this->getPostIdByUrl($objectUrl));
	89	+ $postType = $post->post_type ?? '';
92	90
93		- return in_array($fileName, array_column($sizes, 'file'), true);
94		- }
	91	+ if ($postType === ObjectHandler::ATTACHMENT_OBJECT_TYPE) {
	92	+ $multiPath = str_replace('/files', $uploadDir, $uploadDirs['baseurl']);
95	93
96		- /**
97		- * Returns the file the request asks for and tells through $isImage whether it can be shown as image.
98		- * A requested generated size is only used if it is registered at the attachment and stored inside the
99		- * upload directory, so no arbitrary and no missing file becomes reachable. Generated sizes are always
100		- * images, also for documents like PDFs, where they are the preview images shown in the media library.
101		- */
102		- private function getAttachmentFile(
103		- int $attachmentId,
104		- string $attachedFile,
105		- string $requestedUrl,
106		- string $uploadBaseDir,
107		- ?bool &$isImage
108		- ): string {
109		- $requestedFileName = basename((string) parse_url($requestedUrl, PHP_URL_PATH));
110		- $sizeFile = dirname($attachedFile) . DIRECTORY_SEPARATOR . $requestedFileName;
	94	+ $fileObject = $this->fileObjectFactory->createFileObject(
	95	+ $post->ID,
	96	+ $objectType,
	97	+ $uploadDirs['basedir'] . str_replace($multiPath, '', $objectUrl),
	98	+ $this->wordpress->attachmentIsImage($post->ID)
	99	+ );
	100	+ }
	101	+ } else {
	102	+ $extraParameter = $this->getRequestParameter('uamextra');
111	103
112		- if ($requestedFileName !== basename($attachedFile)
113		- && $this->isRegisteredSize($attachmentId, $requestedFileName) === true
114		- && $this->isInsideUploadDirectory($sizeFile, $uploadBaseDir) === true
115		- ) {
116		- $isImage = true;
117		-
118		- return $sizeFile;
	104	+ $fileObject = $this->wordpress->applyFilters(
	105	+ 'uam_get_file_settings_by_type',
	106	+ $fileObject,
	107	+ $objectType,
	108	+ $objectUrl,
	109	+ $extraParameter
	110	+ );
119	111	}
120	112
121		- $isImage = $this->wordpress->attachmentIsImage($attachmentId);
122		-
123		- return $attachedFile;
	113	+ return $fileObject;
124	114	}
125	115
126		- private function getAttachmentFileObject(string $objectUrl): ?FileObject
127		- {
128		- $uploadDirs = $this->wordpress->getUploadDir();
129		- $requestedUrl = $this->normalizeAttachmentUrl($uploadDirs, $objectUrl);
130		- $postId = $this->getPostIdByUrl($requestedUrl);
131		-
132		- if ($postId < 1) {
133		- return null;
134		- }
135		-
136		- $post = $this->objectHandler->getPost($postId);
137		-
138		- if (($post->post_type ?? '') !== ObjectHandler::ATTACHMENT_OBJECT_TYPE) {
139		- return null;
140		- }
141		-
142		- // Unfiltered, because the plugin denies the path through the get_attached_file filter for
143		- // users without access. Filtered it would hide the file from the access check below, which
144		- // then could not answer the request with the no rights page any more.
145		- $attachedFile = $this->wordpress->getAttachedFile($post->ID, true);
146		-
147		- if ($attachedFile === false
148		- || $this->isInsideUploadDirectory($attachedFile, $uploadDirs['basedir']) === false
149		- ) {
150		- return null;
151		- }
152		-
153		- $file = $this->getAttachmentFile(
154		- $post->ID,
155		- $attachedFile,
156		- $requestedUrl,
157		- $uploadDirs['basedir'],
158		- $isImage
159		- );
160		-
161		- return $this->fileObjectFactory->createFileObject(
162		- $post->ID,
163		- ObjectHandler::ATTACHMENT_OBJECT_TYPE,
164		- $file,
165		- $isImage
166		- );
167		- }
168		-
169		- private function isInsideUploadDirectory(string $file, string $uploadBaseDir): bool
170		- {
171		- $realFile = $this->php->realpath($file);
172		- $realUploadBaseDir = $this->php->realpath($uploadBaseDir);
173		-
174		- return $realFile !== false
175		- && $realUploadBaseDir !== false
176		- && str_starts_with($realFile, $realUploadBaseDir . DIRECTORY_SEPARATOR);
177		- }
178		-
179		- private function getFileSettingsByType(string $objectType, string $objectUrl): ?FileObject
180		- {
181		- if ($objectType === ObjectHandler::ATTACHMENT_OBJECT_TYPE) {
182		- return $this->getAttachmentFileObject($objectUrl);
183		- }
184		-
185		- $extraParameter = $this->getRequestParameter('uamextra');
186		-
187		- return $this->wordpress->applyFilters(
188		- 'uam_get_file_settings_by_type',
189		- null,
190		- $objectType,
191		- $objectUrl,
192		- $extraParameter
193		- );
194		- }
195		-
196	116	/**
197	117	* @throws UserGroupTypeException
198	118	*/
199	119	public function getFile(string $objectType, string $objectUrl): void
		@@ -267,12 +187,8 @@
267	187	$url = $this->getRedirectUrlAndPermalink($permalink);
268	188	$currentUrl = $this->util->getCurrentUrl();
269	189
270	190	if ($url !== null && $url !== $currentUrl && $permalink !== $currentUrl) {
271		- if ($this->mainConfig->appendRedirectToParameter() === true) {
272		- $url = $this->wordpress->addQueryArg([self::REDIRECT_TO_PARAMETER => $currentUrl], $url);
273		- }
274		-
275	191	$this->wordpress->wpRedirect($url);
276	192	$this->php->callExit();
277	193	}
278	194	}
		@@ -281,12 +197,12 @@
281	197	{
282	198	$postableTypes = implode('\',\'', $this->objectHandler->getPostTypes());
283	199
284	200	$query = $this->database->prepare(
285		- "SELECT `ID`
286		- FROM `{$this->database->getPostsTable()}`
287		- WHERE `post_name` = %s
288		- AND `post_type` IN ('$postableTypes')",
	201	+ "SELECT ID
	202	+ FROM {$this->database->getPostsTable()}
	203	+ WHERE post_name = %s
	204	+ AND post_type IN ('$postableTypes')",
289	205	$name
290	206	);
291	207
292	208	return (int) $this->database->getVariable($query);